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Abbreviations and Definitions 



Abbreviation 



■ 



ACC 
BC 

ChannellD 

LPRF 

MAC 

MU 

RMAP 

SU 

T 

w 

TCH 

EC 

ED 



Meaning 



Associated Control Channel 
Broadcast 

Channel Identification, a 4-bit field in the burst header identifying one of 16 possible 
channels 

Low Power RF 

Medium Access Control 

LPRF Master Unit 

remote memory access protocol 

LPRF Slave Unit 

LPRF symbol duration (1/812500 s) 

LPRF slot duration (1 0/1 3 ms) 

traffic channel field of LPRF bursts (variable length) 

error correction 

error detection 




2 Definitions 



Term 


Definition 


Carrier 


A carrier frequency used for communication 


Channel 


A TDMA channel. Bursts with a common ChannellD establish a TDMA channel on a 
selected carrier 


downlink 


direction from MU to SU 


ED-message 


a message that is sent over the ACC of the LPRF burst which is protected by low level 
error detection (ED) using a CRC 


EC-message 


a message that is sent over the ACC of the LPRF burst which is protected by low level 
error correction (EC) using a send & wait protocol 


f-channel 


a TDMA channel between MU and SU with fixed capacity 


host unit 


a communication device, that uses an LPRF MU for communication with other devices 
via LPRF SUs. 


master unit 


an LPRF interface that sets timing for an LPRF communication and can handle commu- 
nication with several slave units. The master unit logically resides in a host unit and is 
controlled by the host unit. 


passive slave 
unit 


a slave unit that does not contain a transmitter but only a receiver. Thus, such a slave 
can only evaluate broadcast information. 


slave unit 


an LPRF interface that listens to LPRF MUs and can handle communication with only 
one MU at a time 


sleep mode syn- 
chronous bursts 


bursts that are sent regardless of whether the MU is in the sleeping state or active 
SUs that listen to these bursts do not need to change timing if the MU state changes 
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• Term 



Definition 



Splink 




nnel 



direction from SU to MU 

a TDMA channel between MU and SU with variable capacity allocated by the MU dy- 
namically to the channel 
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Introductory comments to LPRF-FH and this document 

This document describes the LPRF system with frequency hopping modifica- 
tions as needed to be permitted to raise the transmitter output power to above 
0 dBm as required to achieve in house coverage for the HomeRF concept. 

The basic approaches as required to handle the frequency hopping system are 
taken from 111. Besides that the ideas of aligning timing to a host system (eg 
cellular system) to simplify the integration have been taken from the orignal 
LPRF system and are proposed in a form that fits the requirements of the fre- 
quency hopping approach. 

In some sections parameter comparisons to 11 1 are made. 
Changes to I2I are marked with revision bars. 

This revisions assumes an air bit rate of 812.5 kbit/s. By using 1 MBit/s as in 
11 1, the link capacities can be scaled up accordingly. 

CAUTION: In this document the terms LPRF and LPRF-FH are used 
equally, although the original LPRF system has significant differences to 
the proposed system. 
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5 LPRF overview 
i 

The LPRF system provides a fully digital link for communication between a 
master unit and one or more slave units. The system provides a radio link that 
offers a high degree of flexibility to support various applications and product 
scenarios. 

Channels with a fixed known capacity and delay are provided between master 
and slave(s) (f-channels) as well as packet mode channels with variable delay 
and throughput (v-channels). 



5.1 LPRF Major Features Summary 



Table 1. Features summary 



..... parameter 






network topology 


star 


star configuration with one MU (eg a cellular phone) 
communicating with up to 31 SUs concurrently 


coverage range 


< 10 m 

< 100 m with PA 


- even less acceptable 

- LOS range can be much larger 


number of concurrent 
users (piconets) 


> 20 


estimate, theoretically frequency division gives 79 us- 
ers 


link capacity 


up to 2x339 kbit/s or 
1x613 kbit/s 


For these figures 100% of air time needs to be avail- 
able for communication, ie no air time is blocked by 
interference from other systems or cellular transmis- 
sion. 


timing can be aligned to 
cellular system frame 
timing 


must support GSM, 
PDC,D-AMPS + 
CDMA (IS-95) 


multiples of the slot timing are equal to the respective 
cellular timing. 


frequency band 


2.4-2.5 GHz 


ISM band, best choice with respect to to global usage 
and cost 


multiplexing 


frequency hopping 
spread spectrum + 
TDM 


- hopping rate 1300 hops/s 

- complies with FCC and ETSI type approval regula- 
tions in the ISM band for power levels above 0 dBm 


output power 


OdBm or higher 


0 dBm for low power devices, higher levels for Hom- 
eRF applications 


link characteristics 


variable rate, connec- 
tion oriented and con- 
nectionless 


from very low (vibra- or buzzer-slaves) to high (audio, 
data) data rates, either fixed capacity allocated or dy- 
namically arbitrated by the MU 


air interface timing 


fixed slot timing, but 
configurable allocation 
of slots to channels 


the allocations can be done such, that critical concur- 
rent activities of LPRF and the host system are avoided 
(eg concurrent transmissions). This is facilitated to 

- support coexistence in a cellular host system 

- ease type approval 

- simplify RF design 


native audio mode 


A-law PCM transmis- 
sion 


other modes (eg CVSD coding as proposed in 111) can 
be added but are not yet specified 
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Table 2. Summary of features that support independency of cellular standards 



Host system property or in- 
tegration issue 


Supporting feature 


not much power available 


the system design permits that the LPRF MU enters a sleep mode to^^^f 
power 


close integration may lead to 
RF front end interference 
problems 


The allocation of slots to channels can be done such that LPRF does no^^ 
transmit concurrently with the cellular system. As a consequence, the 
burst length is variable as well as some timing parameters (frame length, 
sleep mode timing, etc.). 


A SW oriented MU imple- 
mentation has to coexist with 
the cellular DSP SW 


The proposed approach prevents, that the SW has to manage two com- 
pletely different time scales (frame timing, slot timing). 


sudden slot changes 


The LPRF SU is designed such, that a burst from the MU can be delayed 
significantly without loosing the connection. This effect was considered 
when determining the length of the synchronization preambles of the burst. 



5.2 LPRF Network Topology and Channels 

5.2.1 Network topology and MU-SU relation 

LPRF uses a star topology for communication between an MU and several 
SUs. The MU sets all relevant air interface parameters such, that coexistence 
with the cellular phone is aided. 

✓N communication interface 



LPRF Slave Unit 

(synchronizes to 
jriaster unit^ 




LPRF Master Unit 

(uses the time base of the 
reference system) 






LPRF Slave Unit 

(synchronizes to 
master unit) 



D 



PRF Slave Unit 

(synchronizes to 
master unit) 



LPRF Network 





Figure 1 . Basic LPRF Network Setup 

As a consequence, an MU cannot generally at the same time function as an SU 
in another LPRF network since the other network may use a completely differ- 
ent frame timing. However, a unit can of course time multiplex its role in particu- 
lar if it is in its sleep mode with respect to one of the two networks (cf 111). 

As far as the relation between MU an SUs are concerned, four different states 
are distinguished: 
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Table 3. MU-SU relation 



delation of SU to 
g^^an MU 


maximum number 
of concurrent SUs 


Comment ; ^:f^* - - 


^^^Begistered 


oo 


The SU has not been registered to the MU and access permis- 
sion for public services only. 


registered 


65535 


The SU has access permission even to privileged services (such 
as initiating a phone call), but has no radio connection. 


logged in 


error 


i ne ou nas coniacieo me iviu recenxiy. i ne ou is listens xo mu 
broadcasting, but is not actively exchanging data and does not 
occupy a TDMA channel. The SU may be paged by the MU to 
initiate communication and vice versa. 


active connection 


15 + 16 


The SU is logged on, is associated with a TDMA channel and 
can exchange data. 

- A single MU can handle at most 15 variable capacity and 16 
fixed capacity channels concurrently. 



With respect to all parameters given in Table 3, the actual MU implementation 
may be more restrictive than the LPRF air interface in general. Minimum re- 
quirements have not been specified so far. 



5.3 LPRF radio burst structure and timing 

5.3.1 Burst structure overview 

The LPRF burst consists of three parts, as shown in Figure 2. The first part is 
the preamble which is used for symbol and burst synchronization. The second 
part is a header, that contains control information which is partly protected by 
forward error correction. In particular the header contains a 32-bit associated 
control channel used for internal signaling. The third part is the actual payload 
which is variable in length from 0 to 511 bytes and protected with a CRC. The 
CRC is not transmitted if the TCH is empty. Please refer to section 6.1 for more 
details on the contained fields. 

Major features of this burst structure are 

- preamble aids robust synchronization 

- explicit channel ID permits flexible arbitration of data channels (no fixed air 
time allocation necessary) 

- independent low level ARQ support for payload and control channel 

- the control channel always available without stealing link capacity 

- variable burst length 

-> avoids filling up frames with dummy data (power consumption!) 
-> eases future upgrades and changes 

- payload can be reteievd even if header CRC fails (independent protection of 
TCHIength!) 
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48 bit 



80 bit 



0-511 byte (4088 bit) 



16 bit 



Preamble 


Header 


TCH (Payload, variable length) 


CRC 




I — 

32 bit 



32 bit 



16 bit 





Control Fields ; 


• ACC 
Assoc. Control Channe I 


CRC 




\ Extended Hamming Code (16,11) 






1 

i 

■ 


11 bit 


1 

5 bit 8 bit 




8 bit 



TCH retrieval information 
(inch length information) 


Parity v- 
checks 


General Control ; 
(incl. channel ID) 


Control of ACC : 


9 bit 


1 |l 


9 bit 


4 bit 


1 |1 


4 


1 


1 


1 |1 


1 | 3 



TCHLength 



VChannel 
TCHfec 



ChannellD 



res. 
firstSlot 
TCHAck 
TCHSeqNo 



res. ACCLength 
ACCAck 

ACCSeqNo 
ACCUser 
ACCarq 



Figure 2. LPRF burst structure 



5.3.2 LPRF timing 

A major target in the design of the LPRF system was to make integration into a 
cellular phone as efficient as possible. It was thus decided that the timing of the 
LPRF air interface should satisfy the following constraints to ease coexistence 
of LPRF with a cellular phone transceiver and its activities: 

1 The sleep mode of the air interface should be configurable to permit 
a common sleep mode timing for the cellular system and LPRF. 

2 The timing of the LPRF system should be aligned to the cellular sys- 
tem timing to ease integration and type approval. The timing has to 
follow timing changes of the cellular system such as changing timing 
advance and slot changes in TDMA systems. 

3 At least GSM, D-AMPS, PDC and CDMA (IS-95) need to be consid- 
ered during the system design. 

As a consequence the following features have been implemented: 
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- Although a fixed hopping rate (and slot timing) has been chosen, the num- 
ber of slots that build a frame are kept programmable to aid coexistence 
with cellular systems. The slot length was chosen such that integer multiples 
result in frame lengths that equal those of the currently known cellular sys- 
tems. 

- All major remaining timing parameters, ie duplex timing, burst length and 
paging period are set by the MU for every connection (cf section 6.3). 

- Significant spontaneous delays of MU burst transmissions, eg due to hand- 
over in the cellular system, are supported (they are called timing slips in 
LPRF) 

Besides that, the LPRF system is a TDMA/TDD system. 
Advantages of aligned timing 

Timing alignment of sleep modes offers the following advantages 

- the delay of incoming calls to the remote side can be minimized since a re^ 
ceived cellular paging can within milliseconds be used to wake up remote 



- only one sleep mode needs to be handled in the phone (MU) 
Timing alignment to cellular frames provides the following advantages 

- concurrent transceiver activities can be avoided as needed to aid type ap- 
proval and hardware design (eg RF shielding requirements) 

- peak load of SW can be reduced by putting activities into non-overlapping 
periods 

- HW interface can be shared 

Slot and frame timing (active mode) 

The system uses a fixed slot length of t S | O t=10/13 ms. Thus 6 LPRF slots fit into 
a GSM frame (60/13 ms) and 26 LPRF slots fit into a PDC or D-AMPS frame 
(20ms). The slot length is slightly bigger than that proposed in 11 1 which leads 
to reduced overhead (assuming equal RF setup times). A single slot can carry 
at least 40 bytes of payload. 

Frequency hopping is performed with every slot, thus the resulting hopping rate 
is 1300 hops/s. For handling of bursts that extend over several slots, the same 
rules as proposed in 111 are adopted. 

No fixed guard times are needed to be specified since every burst carries 
length information. Thus shrinking the guard times (and thereby optimizing ca- 
pacity) is possible in high performance systems based on compatibility informa- 
tion that the SUs provide. As well, the MU can multiplex connections such that 
guard speces on the MU side can be reduced while keeping the guard times for 
SUs as they are. This can lead to capacity increases of up to 50 % for single 
slot connections (see below)! 
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l» 



Normally, the transceiver activity starts at the beginning of a slot. However, 
slots can as well be marked as extension slots, which means that the slot is ex- 
tended by 40 bytes. The subsequent slot can then no longer carry payload data 
(cf DMA and DHA packets in 111) and the associated transceiver activity is^ 
delayed by 40 bytes (=40*8*T). 

Whenever bursts extend over more than one slot, the whole burst is sent 
frequency of the first occupied slot. 



id data 
orTTne 



5.3.4 



Physical channel timing and allocation patterns 

A master unit bundles an integer number of slots Np r to build a frame within 
which all activities are performed at fixed offsets relative to the frame start. 
Thus the total frame length is Np r *10/13 ms. To adapt to the timing of cellular 
systems typical choices for GSM are N Fr =6 and for PDC and D-AMPS N Fr =26. 
Multiples can as well be useful (eg for half-rate D-AMPS connections). Within 
the chosen frame, slots can be allocated to channels (ie connections between 
MU and SU) taking various constraints into account. This is configured using 
allocation tables. 

It should be noted that the allocation as such does not require to transmit and 
receive over the full slot length if the payload size is temporarily smaller. Re- 
ceiver and transmitter evaluate the payload length information and thus avoid 
transmission and reception of fill bytes. 



GSM system 



GSM 



downlink 
(MP RX) 

uplink 
(MPTX) 



LPRF system 



GSM 



GSM 



prohibited 
ferea for Tx 



max. available time 



GSM 



prohibited 
ferea for Tx 





1 ' 

1 ■ 


0 


1 


2 


3 


4 


: s 



D = dowlink 

U = uplink 

— = not allocated 

x = extension slot 



1) 


D 


U 










2) 


D 


U 




D 


U 




3) 


D 


Dx 


U 


D 


Dx 


U 



Figure 3. GSM channel timing examples single slot GSM connection 

Figure 3 shows three examples of possible allocation tables for a GSM case 
with Npp=6 and without forward error correction. 

Example 1): This channel allocation may be used to carry a 64 kbit stream in 

both directions (eg audio) which needs one slot in either direction per 
frame. The introduced delay equals the GSM frame timing. 
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Example 2): This allocation offers twice the capacity of example 1) and half the 
delay by allocation every third slot to a downlink or uplink frame. 

Example 3): This would be a unidirectional high speed connection (eg for print- 
ing) extended double slots (downlink). This would provide a 1x547 
kbit/s connection. Reception during cellular transmission needs to be 
possible in this case. 

Table 4 summarizes the resulting channel capacities for single and multi-slots. 
The guard time for RF setup and uplink timing inaccuracy is 198 |xs. 

Table 4. Slot capacities (without FEC, at 812.5 kbit/s air bit rate) 



Scenario 


Max. pay- 
load per 
burst [by- 
tes] 


Capacity @ x-slot frame timing [kbit/s] .- : 


- -, x = 2 : : : :: 


; . x=3 ;' : 


x=4 


x=6 (GSM 
frame) 


x=26 (PDC/ 
D-AMPS 
i ; frame) a \ 


Single slot 


40 


208 






69.33 


16 


Double slot 


118 




409 


306 


204.5 


47.2 


Double slot + 
40 bytes extension 


158 




547 




273 


63.2 


Triple slot 


196 






509 


339 


78.4 


Triple slot + 
40 bytes extension 


236 






613 


409 


94.4 



5.3.5 



MU active mode timing 

All timing changes and allocations are made by the MU, while the SU has to be 
capable to deal with timing changes performed by the MU in the defined ways. 

A typical case is that LPRF frames begin after a host system activity during 
which no LPRF air activity is permitted. Figure 4 shows an example for an MU 
that is hosted in a GSM telephone. LPRF transmission activities are not allowed 
during GSM transmissions, thus the LPRF frames follow directly after a transmit 
of a GSM packet. 

120/26 = 4.615 ms 

7 — h — \ - ~ 



Rx 
GSM 
slot 

Tx 



EE 



01234567 01234567 01 



EZE 



2 3 4 5 6 7 



0 1 



2 3 4 5 6 7 



timing 



LPRF Frame 



^ unused portion of LPRF frame 
Figure .4. LPRF frame timing example in a GSM host telephone 



LPRF-FH: The LPRF system with frequency hopping 
extensions 



Copyright <£> Nokia Mobile Phones 



W CONFIDENTIAL ^^Draft y. 0.2+ 02 Dec 97 
R&D Center Germany 




In the example, the GSM phone is commanded to change communication from 
GSM time slot 0 to GSM time slot 3. The result is a frame timing slip of 3/8 
LPRF frames. Note, that a period at the end of the LPRF frame is blocked 
the GSM transmission, thus LPRF air time allocations cannot be made in 
period. 

As is apparent from the MU frame timing, the SU has to be able to cope witFT 
timing slips. Synchronizing activities to the cellular system is thus an ML) prob- 
lem only. 



5.3.6 Handling of timing slips 

Basically, timing slips will be restricted to multiples of the slot length and the MU 
schedules its frame start to the first slot after a blocked period. The freqency 
hopping pattern is kept unchanged and the frequency that is used in a slot does 
not change due to timing slips. 

However, it is permitted as well to slowly adapt the underlying slot structure to 
follow timing changes due to timing advance and to optimize usage of the avail- 
able air time. 

5.3.7 MU sleep mode timing 

An LPRF master may be quiet for a number of LPRF frames to save power dur- 
ing periods of inactivity of the host systems and the LPRF slaves. The master 
cannot maintain connections when entering the sleep mode, but still sends sys- 
tem information broadcast messages and listens at defined times for incoming 
access bursts from SUs. 

LPRF sleep mode timing can be programmed to a large degree to make it pos- 
sible to align the sleep mode timing to the sleep mode timing of the cellular sys- 
tem. 



5.4 LPRF Channels 

5.4.1 TDMA slots + physical channels 

A channel between an MU and an SU uses downlink and uplink burst that are 
sent and received according to the parameters set by the MU. 

An LPRF burst comprises two sub-channels and several flags. The first is the 
associated control channel (ACC) which is the primary communication channel 
for LPRF internal messaging between MU and SU (used eg for radio resource 
management and SU configuration). The second is the traffic channel (TCH) 
which is the primary communication channel for user traffic. Uplink and down- 
link capacity can be configured differently. The ACC capacity is 32 bit/frame 
and the TCH capacity can be up to 511 byte/frame. However, in practice timing 
and implementation constraints will usually lead to much smaller actual TCH 
capacities. 

The control channel uses a simple send&wait ARQ protocol to protect traffic. 
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For the TCH optional error correction coding with a rate 2/3 code can be se- 
) lected on a burst by burst basis. 

For applications, two different kinds of connections are offered, v-channels and 
f-channels. 

V— channels 

V-channels are variable rate channels identified by a flag in the LPRF burst. 
They may have the same allocation table, providing an aggregate capacity that 
is shared between all active connections and arbitrated by the MU, One 
v-channel is reserved for broadcast applications and access procedures. Up to 
15 v-channels can be used for different connections. The allocation of bursts to 
v-channels is done by the MU and the involved capacity and delay can vary 
considerably. 

V-channels are best suited for data transfer, not for traffic exhibiting a fixed rate 
and requiring a limited delay like voice connections. 

V-channels can be protected by the same simple send&wait ARQ protocol 
used on the associated control channel. 

5.4.3 F— channels 

Every f-channel has fixed allocation of air interface time per LPRF frame which 
is not used by any other channel. They thus have a fixed capacity always avail- 
able to a connection as well as a known worst case delay. 

On every f-channel, the ACC can be used as a separate control channel for 
applications as needed for display and keyboard I/O in wireless handsets. If 
higher capacity is needed (large displays, etc) a parallel v-channel can be 
opened or a special messaging format on f— channels be chosen. 
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4 

I 6.1 



LPRF Air Interface 

LPRF radio burst 

LPRF will pack the user data into a burst consisting of the following fields: 

Table 5. LPRF Burst Structure 




Field 


Length 
[bits] 


Comment 


Packet Synchronization 


SynchHeader 


32 


Preamble for burst detection and timing synchronization 

MU: 0101 ... 0101, first sent bit is '0\ SU uses the inverted MU sequence 


UniqueWord 


16 


Used for determining the absolute timing of the burst. 
MU: 1110 1001 1001 1010, first sent bit is T. SU uses the inverted MU se- 
quence 


Medium Access Control Bits 


TCHIength 


9 


Length of traffic channel field in bytes (0..511) 


TCHfec 


1 


0 = no FEC on TCH 

1 = r =2/3 FEC used 


VChannel 


1 


0 = the burst belongs to a fixed capacity channel (f-connection) 

1 = the burst belongs to a variable capacity channel (v— connection) 


LengthCode 


5 


this field builds together with TCHIength,TCHfec and VChannel a (15,11) 
Hamming code with additional parity check , ie a (16,11) code 


ChannellD 


4 


The number of the physical channel (TDMA channel!), the packet belongs to 
(0..15). Whether this is an f f- or v-channel depends on the VChannel flag. 


TCHSeqNo 




Sequence number for Send&Wait protocol of TCH data 


TCHAck 




Acknowledge for Send&Wait protocol of TCH data 


FirstSlot 




Identifies the first slot of an allocation pattern. This aids rapid reacqisition of 
the allocation patterns after timing slips. 


reserved 




reserved for future extensions 


ACCarq 




0 = only error detection on ACC, 1 = send&wait used on ACC 


ACCUser 




0 = ACC is LPRF internal control traffic, 1 = ACC is user traffic 


ACCSeqNo 




Sequence number for Send&Wait protocol of ACC data 


ACCAck 




Acknowledge for Send&Wait protocol of. ACC data 


reserved 




reserved for future extensions 


ACCLength 


3 


Length information for ACC, 
LPRF mode (ACCuser=0) 

- ACCLength specifies stealing capacity from TCH in 32-bit chunks 
in this mode if ACCLength>0 

- up to 8*32 bit can be stolen from the TCH 

- the TCH does not carry any payload in this case 

- stealing is only permitted on v-channels 
User mode (ACCuser=1) 

- unit is bytes, only 0 .. 4 are valid settings 
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Table 5. LPRF Burst Structure (continued) 



r_ acc 


32 


Associated Control Channel (ACC) data field. Used primarily to control and 
program the LPRF interface over-the-air and to transfer low rate user data. 


^^HerCRC 




Protection for LPRF header computed over the header from field ChannellD 
to field ACC (48 bits) (polynomial: X 16 + X 12 + X 5 + 1) 


User Data Field 


TCH 


TCHlength 
*8 


traffic channel field, used to transfer high rate user traffic (eg audio data) 


TCHCRC 


16 


TCHCRC contains a CRC computed over the TCH with the same polynomial 
as the HeaderCRC 



The header bits are aligned on 16-bit positions to ease a SW implementation. 
Major points with respect to the fixed length header are: 

- 32 bit preamble and 16 bit unique word facilitate robust synchronization 
even if large timing slips occur 

- The length information (TCHlength), TCH coding flag (TCHfec) and the 
v-channel flag (VChannel) are protected with a code (TCHIength+TCHfec- 
Flag+VChannel+LengthCode) that permits retrieving the traffic field (TCH) 
independently of the header CRC. 

- ChannellD and VChannel are used to explicitly identify TDMA channels 
since timing as such is not sufficient for channel identification (timing slips!) 

- An associated control channel (ACC) with 32 bit/frame gross capacity is pro- 
vided. It is primarily used for LPRF internal signaling but can be used as well 
for user traffic in some cases. 

Several parameters that influence the construction of the burst are negotiated 
during connection establishment. In particular: 

- a maximum size of the TCH field is programmed separately for uplink and 
downlink (the corresponding maximum value of TCHlength depends as well 
on coding options). This corresponds to air time allocated by the MU. 

- whether the send&wait protocol is used on the TCH is negotiated 

- data formats to-be used on the TCH are negotiated. Currently specified op- . 
tions are 

1 64 kbit/s a-law audio 

2 raw data 

As is clear from the header, forward error correction can be added on a burst 
by burst basis as well as ARQ transmission. 

No error correction is used on the header because the target worst case error 
rate of 10" 3 is still leading to failing CRC only every 16'th burst. An unrecogniz- 
able failure of the code that protects the TCH information happens only once 
every several hours. If interference hits the burst, it has to hit directly after the 
unique word to affect the TCH information, otherwise, the burst is not received 
due to disturbed preamble anyway. This is considered sufficiently safe. 
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The data fields are sent LSB first. 
'.1-1 Scrambling 

Beginning after the unique word, the final burst is scrambled prior to trans 
sion with a sequence generated in a linear feedback shift register with pol 
mial x 9 + x 5 + 1 . 

6.1-2 Encryption 

The key stream generator is started newly for every frame based on the frame 
number. The key stream generator is started after the unique word, but encryp- 
tion is only applied to the ACC if ACCUser=1 and the TCH, excluding the CRC 
and before forward error correction coding. LPRF internal control traffic is not 
encrypted. 




6.2 Header and TCH error correction and error detection 

LPRF uses the ACC for internal messaging. Two different approaches to pro- 
tect messaging over the ACC are specified, error correction (EC) messaging 
and error detection (ED) messaging. 

ED-messaging: ED stands for error detection. If a message is transferred in 
this mode, the header CRC (16-bit) is used to check the integrity of the mes- 
sage. If the CRC fails, the message is lost. The header flag ACCarq equals 0 in 
this case. 

EC-messaging: EC stands for error correction. A simple send&wait ARQ pro- 
tocol is applied in this case. It uses the one-bit sequence number ACCSeqNo 
and an acknowledge field (ACCAck). The header CRC is used to decide on the 
necessity of retransmissions. The same protocol can be used for messaging on 
the TCH if a channel is configured accordingly. In this case, TCHSeqNo, 
TCHAck and TCHCRC are used to control retransmissions. 

6.2.1 ACC/TCH transmission send&wait protocol 

To achieve maximum simplicity, a simple send and wait ARQ protocol is used. 
The description given below for ACCSeqNo and ACCAck is identically applied 
to TCHSeqNo and TCHAck if error correction is configured for the TCH. 

The rules are: 

1 The initialization values for ACCSeqNo and ACCack on a newly 
installed physical channel are: ACCSeqNo=1 and ACCack=0. 

2 Every correctly received EC-message is acknowledged by the re- 
ceiving party in the next burst that is sent by repeating ACCseqNo in 
the field ACCack. ACCack is ONLY changed if a EC-message is re- 
ceived without CRC failure. 

3 The transmitting party deletes its EC-message from the message 
buffer after the message was acknowledged and inverts ACCseqNo. 
The message is repeated until it is acknowledged except the trans- 
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6.2.2 



6.2.3 



mitting party flushes the data in favour of new data. The ACCSeqNo 
is not changed in this case and the sender has to consider that 
changing the data is only safe if the last received burst had no CRC 
failure, because the receiver may have acknowledged the reception 
in the last (corrupted) frame. 

Coding for the TCH receive information 

Since too many traffic fields would be lost if the traffic field is discarded every 
time the header CRC fails, additional protection for the TCHIength field, TCHfec 
flag and the V-channel bit is used to enable retrieving the TCH even if the 
header CRC failed. 

For the header that contains 80 bits including the CRC and at a link error rate 
of 1CT 3 , every 1/(1-(1-0.001) 80 )=13'th burst the header CRC fails. However, 
only in one of 67 bursts the length field is actually corrupted. Additional error 
correction coding is thus used for the length field in order to enable retrieval of 
the TCH field even in the case of a header CRC failure. In turn the CRC protec- 
tion of the first two header bytes is disabled which improves the rate of header 
CRC failures to every 1/(1 -(1-0.001 ) 64 )=16'th burst. 

A protection with a (15,11) Hamming code and an additional even parity check 
is used. This permits correction of single errors and detection of 2 errors in the 
code word. The 11 bits are composed out of the 9 TCHIength bits, the TCHfec 
flag and the V-channel bit. 

For an error rate of P e =1 0~ 3 and random errors, we obtain the following proba- 
bilities for E errors in the 16 bits of the coded length field: 



= .9841 
= 1.576M0" 2 
= 1.1 83*1 0- 4 
= .5546*1 0" 6 



P(E=0) =(1-P e ) 16 

P(E=1) = 16 P e (1-P e ) 15 

P(E=2) =(16*15/2) P e 2 (1-P e ) 14 

P(E>2) = 1-P(E=0)-P(E=1)-P(E=2) 

Using single error correction 

1 every 1/P(E=2)=8450'th burst is lost due to a recognized corruption 
of the TCHIength field (ie every 39 seconds with GSM frame timing) 

2 every 1/(P(E>2)=1 .8*1 0 6 'th burst, a corrupted TCHIengthJield is not 
- - detected by the cdde'because the rerrors"~produced a valid code word 

(ie. every 2.3 hours with GSM frame timing) 

By further plausibility checking on the computed TCHIength value, the second 
case can be made even more seldom. 

Further protection is not applied since an interferer would have to hit directly 
after the unique word to destroy data with a burst error although the burst is re- 
ceived. 

TCH forward error correction 

The (16,11) code that is used for protection of the TCH retrieval information is 
shortened to (15,10) and used for r=2/3 forward error correction code if the 
header flag TCHfec equals 1 . 
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The length field TCHIength always counts actual traffic not coded traffic. If the 
I last word of the (1 5,1 0) code is incompletely filled with data, the missing data is 

completed with 0 bits. Thus the effective number of bits transferred in this case 
is |TCHIength*8/10"l*-|5 bits. 
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Figure 7. V-channel downlink structure (MU -> SU) 

Figure 7 depicts the downlink channel structure for v-channels. The key prop- 
erties are: 

- the downlink TCH of V[0] carries user level broadcasting for all listening de- 
vices (even passive SUs). 

- LPRF system broadcasting is done at least on the first slot of the allocation 
pattern, on sleep mode synchronous bursts and on V[0]. The channel iden- 
tification does not matter with respect to system broadcast messages. 

- non-broadcast ACC messages are addressed to a certain SU by means of 
the channel identification. 

- The TCH traffic is as well addressed to a certain SU by means of the chan- 
nel identification, information that is broadcasted on the TCH of V[0] can be 
used by all SUs. 
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Figure 8. V-channel uplink structure (SU -> MU) 

Figure 8 depicts the uplink channel structure for v-channels. The dashed lines 
indicate information from the received downlink burst in the same frame. The 
key properties are: 

- uplink TCH and ACC are explicitly arbitrated by the MU. The MU achieves 
this by setting the channel identification in the downlink burst. The SU that is 
associated with this channel is allowed to respond in the uplink burst. The 
received downlink information is shown in Figure 7 with the dashed line. 

- the downlink of V[0] is reserved for broadcast messages. 

- the uplink of V[0] is reserved for access messages, if the broadcast bit Ac- 
cessAllowed equals 1 (cf section 6.8.1). 

- if AccessAllowed equals 0, the MU either does not attempt to receive any 
traffic in the uplink slot to save power, or waits for defined messages from 
the SU in some protocol procedures. 
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^.4.3 



6.4.4 



I 



F-channels (fixed capacity) 

F-channels are channels with a fixed allocated capacity. They are identified by 
setting the VChannel header field in the LPRF bursts to 0. The ChannellD field 
is used to distinguish 1 6 f-channels. Below we use the abbreviation F[x] for the 
f-channel with ChannellD=x. The MU allocates fixed air time to an f-channel 
for up- and downlink. Thus, the capacity is always available for communication 
and no further arbitration is done by the MU. F-channels are thus better suited 
if fixed delays are required for the channel. They are intended to be used pri- 
marily for transmission of fixed rate data streams, eg audio channels that can- 
not tolerate delay due to arbitration. 

SUs that do not need f-channels do not need to support them. 

In contrast to v-channels, for which no user traffic is permitted on the ACC, the 
ACC can be used as a control channel. A typical case for the use of an f-chan- 
nel is an SU that is a cordless handset with audio, keyboard and display. This 
channel would carry for example A-law PCM on the TCH in both directions and 
exchange control messages over the ACC. If the capacity of the ACC is insuffi- 
cient, a parallel v-channel can be used for control messaging at the price of 
higher air interface activity (ie power consumption) 

Typical channel setup scenarios 

The LPRF system can be used in different cellular TDMA environments. The 
main representatives for cellular systems are GSM, CDMA and PDC/D-AMPS, 
the latter two having the same frame timing. 

It is assumed below, that one f-channel for audio transmission (64 kbps A-law 
PCM) a slow v-channel V[0] and a higher throughput v-channel V[1] is han- 
dled. 

Note that these scenarios are given under the assumption that the host unit 
aligns the LPRF timing to that of the cellular host system and that the mobile 
transmit time is prohibited for LPRF activities. This is not an LPRF requirement 
but it is assumed that host units can benefit from aligning the LPRF timing 
such. 



6.4.4.1 GSM scenario- 



The cellular burst consumes 1/8 th of the cellular frame. Allocation patterns 
span over 3 GSM frames or 18 LPRF slots respectively. This permits aligning 
V[0] to GSM cellular sleep modes which span over multiples of GSM 51 mutil- 
frames. 
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D = downlink slot 
U = uplink slot 

- = not allocated for this connection 
Figure 9. GSM timing example for single slot GSM connection 

Clearly, V[0] has only one third of the capacity of V[1], which has identical ca- 
pacity as F[0], ie 64 kbit/s in both duplex directions. The delay of the audio con- 
nection using F[0] is 6 slots or 4.61 ms. 

PDC / D-AMPS scenario 

The cellular burst consumes 1/3 rd of the cellular frame. Frame timing is 20 ms. 
With the given capacity of slots, 4 slot pairs are needed for the audio connec- 
tion (or two double slot pairs). The solution with 4 slot pairs provides better 
delay and is assumed below. 
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Figure 10. PDC/D-AMPS timing example 

V[0] has very limited capcity, while V[1] is assymetric with double slots for 
downlink and thus provides 141 kbit/s for downlinks and 48 kbit/s for uplinks. 
F[0] carried a 64 kbit/s audio stream and is allocated such that the delay is 
minimized (delay is 11 slots = 8.46 ms). A mix of double and single slots is used 
to optimize power consumption (the double slot is not used completely !) 



6.5 Access Identities and Registration 

Any LPRF device has two preprogrammed identities used to manage access, 
authentication and encryption. 

Table 6. LPRF device identities 



Field Name 


>r : ^ : ; ; Description 


i Size ; 


EQI 


equipment identity, 

factory programmed unique serial number, only used for security proce- 
dures (secret identity) 


64 b 


MUaccessI 


MU access identity, 

standard IEEE 802-1990 address (public identity) 


48 b 



Since encryption and authentication is still in the specification phase, the length 
of EQI is not finally decided. The EQI is usually not transferred over the air. It's 
role is the secret component of security procedures. However, if an SU is regis- 
tered to an MU (eg a phone) by putting both sides into a special registration 
mode, the EQI is transferred from SU to MU and stored in the MU as input to 
security algorithms in future communication requests (see below). 

During registration, various other information is exchanged (cf section 6.10.3) in 
particular a 16-bit registration number (RegNum) identifying this particular SU- 
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MU association and the MU access identity, which is stored in the SU to facili 
tate searching and connecting to a certain MU. 

The MU access identity is broadcasted by the MU, to avoid that an SU has. 
inquire to an MU which the SU has not registered to anyway. 



6.6 Security Architecture 

CAUTION: The security approaches are currently being reworked, especially 
with respect to the involved algorithms and necessary wordlengths. 

To aid security in the LPRF system, every LPRF interface (SUs and MUs) will 
be programmed in the factory with a unique equipment identity (EQI) that is the 
secret identity in cryptographic algorithms. Only during SU registration, the MU 
can read the EQI of the SU. Thus, the EQI of the slave can be used later on as 
a secret key serving encryption and authentication procedures between MU 
and SU without sending this key over the air interface. 

Based on this key modern encryption and authentication approaches as ap- 
plied in GSM and DECT can be implemented. 

The following security services have been specified so far: 

- SU authentication (MU validates access rights) 

- session key setting 



MU 



EQI of su 
128 ^ 64 



i 



Algorithms 



16 



Session 
Key 



127 



V 



- 9 



Random Seed (128 bits) 



Authentication Code 



SU 



128 



EQI 

1 



64 



Algorithms 



127 



V 



16 



Authentica- Session 
tion Code Key 



Figure 11. Security Architecture 

6.6.1 Registration 

Since LPRF will not require using separate security modules (eg a SIM card) it 
is necessary to tell the MU about the secret identity of the SU (the EQI). As in 
current cordless systems (eg DECT) the EQI is thus planned to be sent over 
the air from SU to MU which is a potential security problem. 

The following countermeasures are implemented to reduce the probability of 
this event and thus the probability of eavesdropping: 
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1 The SU permits reading the EQI only if the SU is manually set into a 
special registration mode by some user activity 

2 The MU accepts new registration only if the MU is manually set into 
a special registration mode by some user activity 

Thus, registration is only possible if the user puts both devices manually into 
special modes. It is assumed that this is done in a safe environment and sel- 
domly. 

6.6.2 Authentication 

The MU can at any time request authentication by sending an authentication 
command with a 128-bit random seed as parameter. The SU computes a 
127-bit authentication code from the random seed and its own EQI. The MU 
performs the same computation and compares the resulting values. Equality 
means that the authentication succeeded. 

6.6.3 Encryption 

When applying basic encryption to channels, the MU scrambles user data 
(ACC in user mode and TCH) with a sequence generated in a linear feedback 
shift register without regarding the underlying message structure. The 16-bit 
start value is derived from session key and frame number. The key is computed 
from a 128-bit random seed that is provided by the MU. 
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^.7 LPRF internal messaging formats 

To be able to maximize the throughput on the ACC without compromising with 
respect to flexibility, 4 formats are used which differ with respect to the nu 
of different messages and the size of the associated data field. 

Table 7. Message formats for LPRF control messages on the ACC bits 




ACC-Bit 


M28 


M24 


F24 


F16 


24-31 


28 bit data 


24 bit data 


24 bit data 


16 bit data 


16-23 


8-15 


13 bits message 
number 
or address 


7 


7 bits message num- 
ber 


5 bits message num- 
ber 
or address 


6 


5 


4 


3 


3 bits message num- 
ber 


2 


RWI 


1 


1 


0 


0 


1 


1 


0 



6.7.1 



These formats apply if the ACC control field identifies the message as an LPRF 
internal message (ACCUser=0). When mapping information items into the 
ACC, the information is always sent LSB first. User traffic (ACCUser=1) may 
use the ACC in any format. 

M28 messages are mainly used for LPRF system broadcasting (MU->SU) 
since capacity is critical if the MU is sleeping and sends only few packets. 

M24 messages are used in some protocol procedures for throughput critical 
messaging from SU to MU, 

F24 and F16 messages are used to program parameters from MU to SU or for 
example to retrieve information needed for negotiation of parameters using 
virtual memory read/write as specified by RMAP messaging (see below) 

RMAP messaging 

To simplify the handling in the SU, most communication is performed by the MU 
by writing/reading to/from virtual memory locations of the SU. This is done us- 
ing the remote memory access protocol (RMAP). 

While the M28 and M24 messages are dedicated messages to be sent from 
MU to SU or vice versa, F24 and F16 messages contain a field (RWI) that per- 
mits sending data from MU to SU as well as retrieving data from the SU. For 
F24 and F16 messages, the message number is thus treated as an address 
and the underlying mode is a memory in the SU that is written to or read. How- 
ever, at least for the write messages, the address could as well be interpreted 
as a message number. 
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It is intended to exchange most information between master and slave using 
) the remote slave memory access. This access is only available if a slave has 

connected to a master on a dedicated physical channel. This does not imply 
that the slave has been granted access (for user traffic) by the master already. 
The master may only have opened a physical channel to be able to determine if 
this slave's connection request can be served or has to be refused. 

RMAP uses messages in the F24 or F1 6 format. They can be transferred as 
ED- or EC-messages depending on the purpose. The RWI field is used as fol- 
lows: 




Table 8. Meaning of the RWI field 



Field 


Direction 


Value 


function -:"[' . 


RWI 


MU->SU 


0 


write to slave memory / message 




MU->SU 


1 


read request to slave 




SU->MU 


0 


slave memory lookup 




SU->MU 


1 


interrupt / message 



The following activities are possible using the RMAP message format: 

Write (Master->Slave): The master writes a 16-bit word to the defined slave 
memory address. The activity is protected by the EC-message 
transmission protocol. 

Read (Master->Slave): The master requests a read to the designated slave 
memory address. The content of the data field is ignored by the 
slave. The slave responds to the read command by sending a 
memory lookup with the requested address. 

Slave Memory Lookup (Slave->Master): The slave sends the content read 
from the indicated slave address to the master. This happens in re- 
sponse to a read from the master unit to complete the masters read 
operation. The slave is as well allowed to respond to write mes- 
sages with a memory lookup to acknowledge the write operation, if 
the messaging channel is not used by other traffic. 

Interrupt (Slave->Master): The slave may send an interrupt message to the 
master if an activity of the master has to be initiated by the slave. 
The address field identifies different interrupts, while the data field 
may carry side information for this interrupt. 

Together with a memory map of an LPRF slave and within the functionality vis- 
ible in the memory map, the master has full control of the slave. 

The size of the fields is given either in bytes (B) or bits (b). Time values are giv- 
en in multiples of the LPRF symbol rate (T) if not defined otherwise. The tables 
contain two address fields. One for F16 access and the other for F24 access. 
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r 8 LPRF system broadcasting (M28 messages) 

LPRF system broadcasting is done to inform SUs about various parameters 
that the SU needs to know to be able to contact the MU and to manage c 
changes, etc. This kind of broadcasting uses special messages that are s 
the v-channel downlink ACC. 

M28 messages contain 28 bits of data and are optimized for throughput since 
the ACC capacity is quite small in some system modes, particularly if the MU is 
sleeping. In particular, sleep mode synchronous bursts (from MU to SU) always 
contain a M28 message. They are primarily used in the MU for system broad- 
casting. 

6.8.1 System broadcast Information overview 

Table 9 describes the meaning of the different message fields that are con- 
tained in the different M28 messages. 

Table 9. Information items to be distributed using LPRF system broadcasting 



i 



i 



Information 
item i 


size 
(bit) 


comment 


MU status information (BCS information), sent in every BC burst 


AccessAllowed 


1 


AccessAllowed = '0': no uplink allowed 

AccessAllowed = '1': an access message is allowed to be sent after 
any received v-channel burst with ChannellD=0 


SleepBurst 


1 ' 


informs SUs that a sleep mode synchronous burst is sent if set to 1 


SleepMode 


1 


informs the SUs that the master is currently in the sleep mode if set 
to 1 


Access information (BCA information), sent every 3'rd BC burst 


BCSeqNo 


2 


sequence number of broadcasting 

changes if BC information changes, to ensure that the SUs can de- 
rive always a consistent set of parameters. The value 0 can be used 
when broadcasting a default parameter set by the MU (which then 
eases synchronizing to the MU). Thus only 1 ,2,3 should be used if 
no default parameter set is used. 


MUacces- 
sl(31:0) 


32 


The part of MUaccessI is broadcasted to permit identification of the 
MU without connecting to. Cf Table 6. 


Ndown 


4 


offset of V[0] downlink within chosen frame 


Ntdd 


3 


duplex timing for V[0] in number of slots 

actual duplex timing is N TDD *t s!ot + extension time (see below) 


ExtDuplex 


1 


duplex extension flag 

0 = do not add extension time to duplex timing 

1 = add extension time to duplex spacing (40*8*T) 


N F r 


7 


frame timing in multiples of the slot length t S | 0 t (10/13 ms), 
permits up to 98 ms 


SleepFrames 


10 


sleep mode factor for frame timing 

sleep timing = SleepFrames*t stot *N Fr (10 bit allow up to 4.73 s @ 
GSM frames: 4.61 ms) 


Auxiliary information (BCX information), sent if neccessary 
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Table 9. Information items to be distributed using LPRF system broadcasting 

(continued) 



i 



l^^^rmatioh 


size 
(bit) 


comment.';;. 




26 


Current value of LPRF MU slot counter, needed to synchronize multi- 
frame counter and hopping frequency generator 


MAC (BCM information), sent if neccessary, prioritized 


Data 


20 


Information depending on the MsgNo 


MsgNo 


3-4 


Number determining the message (see 6.8.3) 



If a BCM or BCX message replaces a BCA message in a sleep mode synchro- 
nous burst.the replaced message is sent directly in the following (non-sleep) 
V[0] burst. 

Notel : If the auxiliary information is really required to be broadcasted depends 
on the implementatd customization schemes. 

6.8.2 System broadcast message definition 
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Table 10. F28 messages from MU to SU 



ACC 
-Bit 


Message 
0 


Message 
1 


Message 
2 


Message 
3 


Message 
4 


Message 
5 


Message 
6 


Message 


31 


BCSeqNo 


BCSeqNo 


BCSeqNo 


MUacces- 






BCM 




30 














see 6.8.3 




29 


Ndown 


ExtDuplex 














28 




Ntdd 














27 


















26 


















25 


Sleep- 

1 1 CM 1 ICO 
















24 
















23 


















22 




N F r 














21 






MUacces- 
sl(15:0) 












20 
















19 
















18 


















17 


















16 


















15 


MUacces- 
sl(31:24) 


MUacces- 
sl(23:16) 














14 














13 


















12 


















11 


















10 


















9 


















8 


















7 


reserved 




6 


Access Allowed 




5 


SleepBurst 


4 


SleepMode 


3 


0 


0 


0 


0 


1 


1 


1 


1 


2 


0 


0 


1 


1 


0 


0 


1 


1 


1 


0 


1 


0 


1 


0 


1 


0 


1 


0 


1 



I 



Notel : Message 6 is directly acknowledged on the uplink, which is accordingly 
blocked for access messages. If message 6 has been sent during a sleep burst 
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the next message will be on V[0] with AccessAllowed = 1 to allow faster access 
from the SUs. 

MAC Messages (BCM) 

This message contains several different messages that are (normally) sent dur- 
ing the sleep burst. AccessAllowed is 0, only the SU that is addressed directly 
by its registration number is allowed to answer. 

If a MAC message is sent during a sleep burst the next v-channel burst is V[0] 
with AccessAllowed = 1 to allow other SUs to send a CONNECTJNQ mes- 
sage. 

Table 11. BCM messages 




6.8.4 System broadcasting in sleep mode synchronous bursts 

Sleep mode synchronous bursts are bursts, that are sent regardless of whether 
the MU is in the sleep mode or not. An SU may thus enter a sleep mode syn- 
chronized to these bursts (ie with timing t S | 0t *N Fr *SleepFrames) and would not 
need to change the timing if the MU enters or leaves the sleep mode. Every 
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^ sJeep mode synchronous burst carries a broadcast message on V[0]. Multiplex- 

W ing the broadcast messages into these bursts is done in the following way: 

1 BCS information is sent in every burst 

2 A basic broadcast cycle of BCA messages comprises 3 bursts 
which messages 0-2 are sent. 

Paging (BCM) and auxiliary broadcasting (BCX) information are only sent in the 
respective cases. BCX or BCM messages are prioritized over BCA messages, 
they replace BCA information that would have been send instead without 
changing the usual cycle of messages. It is up to the MU how to prioritize BCM 
and BCX messages (ie how to weigh their importance). 

Notel : If BCASeqNo equals zero, the SU can assume that the MU uses a fixed 
known default set of BCA information. If the SU has stored this data set earlier 
a faster synchronization to the MU is possible. 

6.8.5 System broadcasting in bursts that are not sleep mode synchronous 

An MU that is not in the sleep mode maintains the broadcasting in sleep mode 
synchronous bursts. SUs can keep their activities accordingly. The MU may ad- 
ditionally transmit broadcast information in bursts other than the sleep mode 
synchronous bursts. This can be done to reduce the time that an SU needs to 
collect a full set of BCA information. 

6.9 M24 messages 

M24 messages are primarily used during connection establishment and discon- 
nection. 
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6.10 Parameter write and lookup (F1 6/F24 messages) 

The address offsets for parameter read/write are not yet fixed. 

6.10.1 Memory Access Control 

This field contains functionality to extend addressing and to protect the memory 
access against invalid commands that may slip through the EC-message-error 
protection (16-bit CRC). 
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Table 13. Memory access control fields 



Field Name 


Description 


R/W 


Effective 
Size 


F16 
Address 
Offset 


F24 
Addj^^ 


Memory Access Control 








Page 


Used to extend addressing by using memory 
pages. 

Note: This address has to be used identically on 
all pages if memory pages are used. 


R/W 


16b 


Oh 




WrResAddr 


write restriction address, if an address other than 
0 is written to this location, only the designated 
address and the addresses for memory access 
control (this block) are enabled for writing (2-byte 
access). 


R/W 


14 b 


2h 




RO 


read only, setting this bit to 1 disables RMAP 
write accesses except for this word 


R/W 


1 b 


2h + 15b 





6.10-2 Static Slave Configuration Information 

Static slave configuration information is stored in non-volatile SU memory (eg 
EEPROM or FLASH) or is hard-wired. 

Table 14. Static Slave Configuration Information fields 



Field Name 


Description 


R/W 


Effective 
Size 


F16 ; 

Address 
Offset 


F24 
Address 
Offset 


GSI fields (General Slave Information) 








HWtype 


SU hardware type, 

this value is used by the MU to identify the appli- 
cable memory map for the upper half of the ad- 
dresses 


R 


8 b 


Oh 




ParSetID 


GSI field parameter set ID, 
if the SU gives a nonzero number here, the num- 
ber is uniquely associated with the particular pa- 
rameter set provided in the GSI fields, le, an MU 
that stores the parameter set is permitted to read 
only this ID and use a previously retrieved param- 
eter set to speed up processing. 


R 


8b 






UserTraffic 


Specifies which user traffic has to be provided on 
ACC and TCH by the MU. 

0 = ACC not used 

TCH carries user data stream 

1 = ACC carries user data stream 

TCH carries a-law encoded PCM 
4-255 = reserved for extensions 


R 


8b 






TCHcapDwn 


required nominal TCH capacity for downlink 
(MU->SU), 

value is given in bits per 10 ms. 


R 


15b 






FixedDwn 


Fixed capacity downlink connection 
0 = not required, 1 = required 


R 


1 b 
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Table 14. Static Slave Configuration Information fields (continued) 







R/W 


Effective 
Size 


F16 
Address 
Offset 


F24 
Address 
Offset 


^BKcapUp 


required nominal TCH capacity for the uplink 
(SU->MU), 

value is given in bits per 10 ms. 


R 


15 b 




- 


FixedDwn 


Fixed capacity uplink connection 
0 = not required, 1 = required 


R 


1 b 






TCHMaxDwn- 
Length 


Maximal TCH length the SU is able to handle in 
the downlink (MU->SU) 


R 


9b 




— 


TCHMaxU- 
pLength 


Maximal TCH lengtn tne bu is auie to nanuie in 
the uplink (SU->MU) 


n 


9 h 






MaxNFr 


maximum nominal frame timing (unit: t S | 0t ) 

(eg due to delay requirements for an audio slave 

or internal buffer limitations) 


R 


8b 




— 


MinDsep 


minimum duplex separation, 

0 < MinDsep < 200 [T] (<245 \is) 

(to be able to switch between Rx and Tx) 


R 


8b 






PSI fields (Protected Slave Information) 








EQI 


equipment identity, 

factory programmed unique serial number, only 
used for advanced encryption and authentication 


R 


64 b 




?h 



Note: PSI addresses can only be read in registration mode since they contain 
information that has to be protected for security reasons. 



6.10.3 Registration Information 



Table 15. Registration Information 



Field Name 


Description 


R/W 


^Effective 

■;::;;Si?e 


F16 
Address 
Offset 


F24 
Address 
Offset 


RGI (registration information, non-volatile SU storage, eg EE- 

PROM) 


256 b 






RegNum 


registration number, 

a non-zero number programmed during regis- 
tration by the MU. RegNum is sent with the 
access message from SU to MU to identify 
which SU wants to access to the MU. 


R/W 


16b 


Oh 




MUaccessI 


MU access identity (cf Table 6) 


R/W 


48 b 


4h 


?h 


reserved 


reserved for future extensions of the registra- 
tion information 




160 b 


Ch 


?h 


RGIx (registration information, non-volatile SU storage) 


(N-1)*256 b 






reserved 


reserved for N-1 more registration access 
data sets 


R/W 


(N-1)*256 b 


40h 


?h 
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^ Note: The RGI fields are only writable in registration mode. Requesting an au- 

P thentication code from the SU is done using the command CAUTH. 

6.10.4 MU/Connection Configuration Information 

Table 15. MU/Connection Configuration Information 




Field Name 


Description 


R/W 


Effective 
Size 


F16 
Address 
Offset 


F24 
Address 
Offset 


GMI (General MU Information) 








Nr 


(cf Table 9) 


R/W 


7b 




— 


Ndown 


(cf Table 9) 


R/W 


4b 






Ntdd 


(cf Table 9) 


R/W 


3b 




- 


ExtDuplex 


(cf Table 9) 


R/W 


1 b 






SleepFrames 


(cf Table 9) 


R/W 


10 D 






SCI (Session Configuration Information) 








DPAGI 


dynamic paging group identity (0.. 65535), 

a dynamic group paging code, used to wake up 

the SU if dynamic group paging is used 


R/W 


16b 




— 


SleepMode- 
Conf 


Sleep mode configuration, tbd 


R/W 


8b 




- 


SSI (Slave Status Information) 








Status 


Status flags of the SU: 

0x01: ALLOW_DISCONNECT = The SU is will- 
ing to be disconnected (eg. it has no user traffic 
to be sent to the MU). The actual DISCONNECT 
decision is done in the MU. 


R 


16 b 






CI (Connection Information) 
(writing directly affects the parameter) 








TCHarq 


Use of send&wait ARQ on TCH data 
0 = not used,1 = used 


R/W 


1 b 






EncEna 


encryption enable, 
0: encryption is off 
1 : encryption is active 


R/W 


1 b 




- 


UserTrafficEna 


0 = only LPRF internal signaling allowed, 

1 = User traffic may be exchanged as negotiated 


R/W 


1 b 






MaxTCH- 
lengthDwn 


maximum permissible length of TCH in bytes for 
the downlink (MU->SU) 


R/W 


9b 






MaxTCHIeng- 
thUp 


maximum permissible length of TCH in bytes for 
the uplink (SU->MU) 


R/W 


9b 






CHI (Channel Information) 
(activated as a data set using the CHAND command, cf sect. 

6.10.5) 








VChannel 


0 = f-channel 

1 = v-channel 


R/W 


1 b 




?h 


ChanellD 


TDMA channel ID 


R/W 


4b 




?h 
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Table 16. MU/Connection Configuration Information (continued) 



^^jeid Name 


Description 


R/W 


Effective 
Size 


F16 
Address 
Offset 


F24 
Address 
Offset 


^HfflocDn 


Downlink slot allocation mask 


R/W 


128 b 




?h 


AllocUp 


Uplink slot allocation mask 


R/W 


128 b 




?h 


AilocExt 


Extension flags to slot allocation masks 


R/W 


128 b 




?h 



For channel handover, the MU programs new parameters into the CHI field and 
use the CHAND. command to make the SU switching to the new parameter set. 

If the carrier needs to be changed special procedures preferably apply (see 
MAC procedures definition) 



6.10.5 SU Commanding 



Table 17. Slave memory map structure 



Field Name 


. ; . Description 


R/W 


Effective 
Size 


F16 
Address 
Offset 


• F24 

Address 
Offset 




COM (Slave Commanding) 


512 b 






OpCode 


write accesses command SUs to perform the indi- 
cated action. Some commands require additional 
parameters as specified in the field(s) ComParX. 


R/W 


8b 


Oh 


?h 


ComPaM 


command parameter 1 


R/W 


8b 


1h 


?h 


ComPar2 


command parameter 2 


R/W 


16 b 


2h 


?h 


reserved 


for 14 more parameters 


R/W 


224 b 


4h 


?h 


COMretl 


command return value 1 


R 


15 b 


. 20h 


?h 


ComStat 


command status, 

0: last command completed 

1 : command is currently being processed 


R 


1 b 


21h+7b 


?h 


COMret2 


command return value 2 


R 


16 b 


22h 


?h 


reserved 


for 14 more return values 


R 


224 b 


24h 


?h 



Table 18 specifies the possible commands. If not mentioned otherwise, a single 
parameter has to be placed in the field COMparl and a single return value is 
placed in the COMretl field. 



Table 18. Command definition 



Code 


Mnemonic 


Short Description 
(SU is commanded to 
' ...) : ; . 


Parameter(s) 
(Com Pari if not stated 
differently) 


Return Value(s) ^ 
(ComRetl if not stated 
.differently) 


0 


NOP 


no operation 








DISCON_Req 


terminate the active 
connection to the MU 


Reason (8 b) 
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Table 18. Command definition (continued) 





CAUTH 


compute authentication 
code 


RandSeed (128 b) 


Code (127 b) 




CENCR 


compute encryption 
key 


RandSeed (128 b) 






CHAND 


perform channel hand- 
over 







6.11 Basic access procedures 

The basic acces procedures are identical to 111 with minor modifications due to 
the extended slot length. Additionally procedures are specified which can be 
used by SUs that are running in a synchronized sleep mode to an MU. 



i 



6.12 Connection establishment 

The SU sends a connection inquiry (CONNECTJNQ) in the uplink of a broad- 
cast downlink on V[0] with the broadcast bit AccessAllowed=1 . The Ml) an- 
swers with a connection request (CONNECT_REQ) which contains the channel 
number to be used for the connection to the SU. 

An MU initiated connection starts as well with a connection request. In any 
case, the SU answers the CONNECTJNQ with an acknowledge (M28 mes- 
sage Ack). After that both parties change to the designated v-channel and start 
communication (on the ACC) mainly with F16/F24 messaging. 

User traffic has to be enabled (allowed) separately by the MU after the channel 
is established. 

In case of timeouts on the SU side (eg sue to collisions) the SU can retry or re- 
vert to the basic access procedures as specified for initial access. 

6.13 Connection release 

When the connection is not needed anymore (eg. there is no more user traffic 
to exchange between MU and SU) the connection is released by the MU with 
sending a DISCON_Req message to the SU. 

In case that there is distortion so that the MU doesn't get the expected re- 
sponse from the SU the MU may disconnect the SU simply by omitting sending 
bursts for this channel. If the SU has not received a burst with the correct chan- 
nel number for a preprogrammed time it will disconnect itself (see also 'sleep 
mode timeout 1 ). 

6.14 Group paging 

During sleep mode synchronous burst the MU is able to send group paging 
messages. The purpose of this messages is to wake up a certain group of SUs 
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(eg. those that need to handle incoming calls) faster. Fixed group paging codes 
are foreseen as well as group paging codes that are dynamically allocated to 
SUs. 



Sleep mode timeout 

If an SU is communicating with an MU it maintains a timer which is restarted 
with every burst that is received on its channel. Expiration of the timer leads to 
immediate change into the SU sleep mode to save power. This watchdog func- 
tionality has been included to avoid that SUs stay active due to channel distor- 
tion or errors in the MU implementation. The resulting power consumption 
would empty the battery of power critical devices very fast. 

MAC procedures messages overview 

This section summarizes messages that are used by MAC procedures. The re- 
maining messaging is done using RMAP accesses and RMAP commands. 

Messages from MU to SU 



Table 19. LPRF MU messages 



Name 


Format 


Used 
Chan- 

; nel 


Sleep 
Burst 


EC/ED 


Description • 


NOP 


F16 


^v[0] 


No 


ED 


No Operation. (Used for testing/debug- 
ging) 
Contents: 


CONNECT_Req 


M28 
Msg. 7 


v[0] 


X 


ED 


Is sent by MU to connect a certain SU. 
Contents: 

- RegNum 

- VChannel 
-ChannellD 


STILL_ALIVE_PAGING 


M28 
Msg. 7 


v[0] 


X 


ED 


Is used to determine if a certain SU is still 

listening. 

Contents: 

- Regnum 


FIXED GROUP_PAG- 
ING 


M28 
Msg, 7 


v[0] 


Yes 


ED 


Is used to awake a group of SUs deter- 
mined by their fixed group address. 
Contents: 
- Fixed PAGI 


DYNAM- 
IC_GROUP_PAGING 


M28 
Msg. 7 


v[0] 


Yes 


ED 


Is used to awake a group of SUs deter- 
mined by their fixed group address. 
Contents: 
- Dynamic PAGI 
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Table 19. LPRF MU messages (continued) 



Name 


Format 


Used 
Chan- 
nel 


Sleep 
Burst 


EC/ED 


Description 


CONNECT_INQ_Rej 


F24 


v[0] 


No 


ED 


MU rejects a CONNECT INQ from th^H 
SU. 

Contents: 
- Regnum 
~™ Reason* 

1) NO_CHANNEL_AVAILABLE: al! 
v-channels 

are currently in use 

0\ thH 


DISCON_Req 


F16 


#v[0] 


No 


EC 


The MU disconnects the SU. 
Contents: 


CHAND 


F16 




No 


EC 


MU initiates a channel handover. Before 
the MU has written the channel parame- 
ters via niviMr. 
Contents: 


CAUTH 




^v[0] 


No 


EC 


SU shall compute the authentication value. 
Before the MU has written the CAUTH pa- 
rameters via RMAP. 
Contents: 


CENCR 


? 




No 







Note: X means any channel 
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.16.2 Messages from SU to MU 





Format 


Used 
Chan- 
nel. 


EC/ED 


Description 


CONNECTJNQ 


F24SU 


v[0] 


ED 


CONNECTJNQ: access message for initial connection 

establishment. 

Contents: 

- RegNum (cf NO TAG) 

- Configuration flag (SU requests default parameters) 
ConfReq = 1 -> Configuration required (eg defaults for 

f-channel) 

ConfReq = 0 -> no configuration required 


DISCONJNQ 


F24SU 


#v[0] 


EC 


DlSCON__REQ: connection release inquiry. 

Contents: 

- Reason: 

0: no reason (this is probably an error condition) 
1 : power down 

2: no traffic (the SU continues listening to channel 0 
and can be paged) 


Ack 


F24SU 


v[0] 


ED 


Ack: Respond to a 'STILL_ALIVE_PAGING' or •CONNECT' 

from the MU. 

Contents: 



6.17 Application Broadcasting (MU->SU) 

Application level broadcasting is done on V[0] (see above). The MU informs 
sleeping SUs about upcoming broadcast traffic such that they can wake up to 
receive the broadcast messages by using the BCupdate flag of the system 
broadcast messages. 

Typical applications for user level broadcasting are ringing indication, battery 
status and field strength update, etc. 



6.1 8 Major air interface parameters 



Table 21. Air interface key parameters 



Parameter 


value 


Comment 


Radio approach 


frequency hopping 


compliant to FCC and ETSI regulations 


Multiplexing 


FDM/TDM 


Time division multiplexing (TDM) between SUs connect- 
ing to a single MU f frequency division multiplexing 
(FDM) between MUs (users). 


TDMA slots 


16+ 16 


explicit TDMA slot numbering in bursts 

16 for f-channels + 16 for v-channels (multiplexed into a 

single physical slot within the frame) 
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Table 21 . Air interface key parameters (continued) 



Pii mlovinn 
i_/U|jic;aii iy 


inn 


aupiex spacing programmable, uplink follows respective 
downlink 


Ri irct lannth 
DUloL Icfiyill 


\do .. 4^4U DltS 


variable with programmable maximum 


Qlrtt I on nth /t . \ 

oioi lengxn \i s iot/ 


lu/io ms 




rrarne lengin 


up to 97 ms 


programmable in multiples of t S | 0t 


Frame timing 




alignable to cellular timing 


Sleep modes 




exist for MU and SU, aligned to cellular system 


Max. single channel ca- 
pacity (SU<->MU) 


>64 kbit/s 


Variable within a wide range and depending on frame 
and burst lengths 


Modulation type 


OPrors 


nominal modulation index 0.32 (GFSK) 


Sensitivity 


-76 dBm 


@ Bit Error Rate 0.001 


Req. signal strength for 
reference BER 


-70 dBm 


reference BER = 0.00001 


Reference oscillator 


13 MHz, 16.8 
MHz, 18 MHz, 
19.2 MHz or 19.44 
MHz 




Reference oscillator stabil- 
ity 


30 ppm 


no AFC Or TCVCXO rPOIlirpH rillP tn Innco cnonifir*atinn 


Air bit rate 


812.5 kbit/s 




Frequency band 


2400-2497 MHz 


ISM band, pure FSK fulfils out of band power require- 
ments with 1 channel guard frequency at the band edges 


Number of carriers 


23..79 


depending on country 


Carrier frequencies 


2402+N*1 MHz 




Carrier spacing 


1 MHz 




Synchronization support in 
the burst 


32 bit preamble 
16 bit unique word 


capable of coping with time slips caused by changing the 
cellular time slot 



[]1 
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ontents: 




1 



Intro 



In the described radio system, timing is adjusted such that a fixed relationship 
to the frame timing of different cellular systems is achieved. By ommitting trans- 
missions, interference and type approval problems due to concurrent activities 
(especially transmissions) of both systes are conquered. 

In this document the timing parameters of GSM and D-AMPS/PDC are consid- 
ered for the derivation of parameters. However, other systems could be taken 
into account as well. 

Note: Since the air interface timing of PDC and D-AMPS is indentical as far as 
is relevant to this document, we use the term D-AMPS only below, although 
PDC is within scope as well. 



To keep a fixed relationship to the cellular frame timings, that makes it possible 
to avoid concurrent transmissions in a simple way and to integrate both sys- 
tems easily, the chosen frame timing has to be a fraction of the frame timing of 
all reference systems. 

For GSM (60/13 ms frame timing) and D-AMPS (20ms frame timing) possible 
frame timings have to satisfy: 

t Fr = 60/1 3/N GSM = 20/N D _ AMPS 



tFr/20 = 3/13/N G SM= 1/N d _ amps 

with N GSM denoting the number of frames per GSM frame and N D _ AMPS the 
number of frames per D-AMPS frame. 

Since 3 and 13 are prime numbers, the possible choices for N GSM and 
N d-amps are: 

Nqsm = 3 * K and N D _ AMPS =13 * K 
with K being a natural number. 

To reduce packet overhead in the radio system, chosing a small value for K is 
preferable. To obtain additionally an even number of frames per cellular frame, 
which permits putting pairs of uplink/downlink activities into the callular frame, 
K=2 is the best choice. Thus we obtain Nqsm = 6 and Nq-amps =26 and ac- 
cordingly T Fr =10/13 ms. 



2 



Choice of frame timing 



or 
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>.1 



GSM case 




system 



GSM 



nlink 
(MP RX) 

uplink 
(MPTX) 



LPRF system 



GSM 



GSM 



GSM 



prohibited 
fere a for TV 



max. available lime 



-3 



prohibited 
£rea for'll^c 



downlink 
(MU TX) 

uplink 
(MU RX) 



I 6 



Figure 1 . GSM timing example for single slot GSM connection 

Figure 1 shows an example for GSM and single slot GSM transmit. For the 
subsystem alternating uplin and downlink frames are assumed. As is visible, 
transmissions during GSM Tx can be avoided by aligning the timing to the GSM 
transmissions. If it is possible to receive during GSM transmit, the full capacity 
is available, otherwise 2/3 of the capacity of the uplink remains, while the down- 
link is still completely available. Frame 5 could for example still carry broadcast 
information. 

For HSCSD 3+1 only one GSM transmit slot is used, thus the same capacity is 
achieved. 



GSM system 
I 



doumrtntc 

(M R RX) 



GSM 



GSM 



uplink 
(MP TX) 



LPRF system 



GSM 



prohibited : 
..area forTx 



downlink 
(MU TX) 

uplink 
(MU RX) 





GSM 




prohibited;)::; ! 
: area' for Tx^= \ 








4 













Figure 2. GSM timing example for HSCSD 2+2 
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2.2 



For HSCSD 2+2, two subsequent GSM slots are used for transmission. Thus 
the timing according Figure 1 would lead to restrictions even if reception during 
GSM transmit is possible. By chosing a different duplex timing for connections, 
the full capacity can be obtained again. ~ 

If no reception is possible during GSM transmit, 2/3 of the total capacity r^ 
mains. 

In any case, fixed delay connections (eg audio) can use every pair of frames 
with a delay equaling to the GSM frame timing. If all three pairs can be used, at 
least the timing according to Figure 1 permits fixed rate connections with 1/3 
and 2/3 of the GSM frame timing are possible. 

PDC/D-AMPS case 



PDC / D-AMPS system 



downlink 
(MP RX) 



PDC / D-AMPS 



"l5'pTX f DC/D - AMPS 



max. available time 



PDC / D-AMPS 



prohibited 
area for Tx 



prohibited 
area for Tx 



□ m 0 0 0 b 0 SS 0! 

STrx, □□□□□ Q 0 E E 0 e s a a a □ 

i i 

' A B A B A BAB '> A 

Figure 3. PDC/D-AMPS timing example 

Figure 3 shows a timing example for PDC/D-AMPS. Clearly four downlink slots 
are blocked even if reception during cellular transmit is possible. The frame 
pairs which are nembered A and B respectively would form two connections 
with similar capacity as one pair of frames within the GSM cellular frame. How- 
ever, the involved worst case delay would be 14*10/13 = 10.77 ms. 

Obviously, PDC benefits even more from using special patterns of frame usage 
that puts uplink frames into the period of cellular transmissions. In the simplest 
case, this could be done by using frames 1-13 for transmission and 14-26 for 
reception. Such a usage pattern would obviously lead to larger delay for individ- 
ual connections. 
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^.3 Frame usage patterns 

As has maybe become clear for the discussed timing scenarios above, the best 
capacity and performance can be obtained if the duplex timing and allocation of 
uplink and downlink to frames are configurable. 

This could be done by broadcasting a default duplex timing for access bursts 
and configuring the actual usage of frames for every actual connection. 
Methods to rearrange the usage pattern in the case of cellular slot changes and 
changing timing advnace need to be implemented. 

2.4 Timing adjustments 

The system should tolerate timing adjustments resulting from changing timing 
advance in the cellular system and/or slot changes. 



3 Frequency hopping 

If the slots are counted without caring about the blocked periods, the system 
can perform a frequency hopping based on the slot timing (in the example 1300 
hops/s). For connections, the missing transmissions can then be handled as if 
the frequency hopper has hit in regular intervals interference that make com- 
munication impossible. A well designed frequency hopping system could thus 
be adapted to the proposed timing without major changes in air interface man- 
agement. 

However, frame usage patterns would provide better efficiency compared to a 
brute force frequency hopping overlay ! 
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^ Implementation into current LPRF incl. frequency 
^ hopping 

4.1 General 

It seem useless to reinvent the wheel, thus the basic access schemes could be 
taken from the MC-link proposal. Thus instantaneous networking could be 
done by sending inquiry trains and paging could be done either as we are con- 
sidering it or using paging trains as used in MC— link. 

The assumption here is that both is supported to provide fast access to syn- 
chronized devices with different paging modes (group paging, etc) as well as 
paging trains as a fallback solution for devices that lost contact and did not 
manage to re-contact again. 

4.1.1 Selected valuable LPRF features missing in MC-link 

™ paging and sleep modes as in LRPF lead to better power efficiency. 

SU power consumption is reduced during sleep mode since since only the 
beacon needs to be received instead of requiring scanning for paging/inqui- 
ry trains in regular intervals. 

- timing alignment 

- registration (at least as an option) to handle security issues. If we rely on 
higher layer access handling (eg using passwords) we may rule out devices 
without Ul (headsets etc.). 

4.1.2 Selected valuable MC-link features missing in LPRF 

- frequency hopping + access schemes — > simplified radio resource manage- 
ment 

- ad hoc networking without registration 

- a common time base for all systems will ease network-to-network commu- 
nication 

- fixed frame timing simplifies multi-frame counting 



• 



4.1.3 Problems/Open Items with frequency hopping approach 

- full range of carriers may prevent global usage (type approval) 

- how to configure slave unit over the air to local restrictions. 

In LPRF the phone was supposed to know restrictions and could broadcast 
these, while the access scheme of MC-link complicates this since the MU is 
assumed to use 32 carriers of the USA/Europe band during inquiry. 

4.1.4 Selected commonalities 

- fast ARQ with HW support 
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Assumption for the discussion below 

The following assumptions are made: 

- 1 300 slots/s 

- LPRF header + 16 bit TCH CRC 



4.3 Timing 

4.3.1 Slot timing and capacity 

- 1300 hops/s and 10/13 ms (=0.769 ms) slot duration accordingly, leading to 
6 slots for a GSM frame and 26 slots for a PDC frame 

- it is assumed the a single slot can carry 40 bytes of data which gives 16 kbit/ 
s capacity for PDC frame timing and slightly more than 69.33 kbit/s for GSM 
frame timing. Thus a 64 kbit/s audio connection can be carried in one slot in 
the GSM case and 4 slots in the PDC case. With the current LPRF header + 
TCH CRC (144 bit), this is possible even if we keep 812.5 kbit/s as the air bit 
rate (with 198 jis guard time remaining). 
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Table 1. Slot capacities 



Scenario ; 


LPRF header 
@ 812.5 ksym/ 
s 


LPRF header 
@ 1 Msym/s 






Single slot ^^^J 


Traffic per burst [byte] 


40 


Capacity @ 2-slot frame timing 


208kbit/s 


Capacity @ GSM frame timing 


69.33 kbit/s 


Capacity @ 20ms frame timing 


16 kbit/s 


Guard time [us] 


198 


305 






Double slot 


Traffic per burst [byte] 


118 


136 






Capacity @ 3-slot frame timing 


409 kbit/s 


471 kbit/s 






Capacity @ 4-slot frame timing 


306 kbit/s 


353 kbit/s 






Capacity @ GSM frame timing 


204.5 kbit/s 


235.7 kbit/s 






Capacity @ 20ms frame timing 


47.2 kbit/s 


54.4 kbit/s 






Double slot + 40 byte (uplink without traffic) 


Traffic per burst [byte] 


158 


176 






Capacity @ 3-slot frame timing 


547 kbit/s 


610 kbit/s 






Capacity @ GSM frame timing 


273 kbit/s 


305 kbit/s 






Capacity @ 20ms frame timing 


63.2 kbit/s 


70.4 kbit/s 






Triple slot 


Traffic per burst [byte] 


196 


232 






Capacity @ 4-slot frame timing 


509 kbit/s. 


603 kbit/s 






Capacity @ GSM frame timing 


339 kbit/s 


402 kbit/s 






Capacity @ 20ms frame timing 


78.4 kbit/s 


92.8 kbit/s 






Triple slot + 40 byte i 


uplink without traffic) 


Traffic per burst [byte] 


236 


272 






Capacity @ 4-slot frame timing 


613 kbit/s 


707 kbit/s 






Capacity @ GSM frame timing 


409 kbit/s 


471 kbit/s 






Capacity @ 20ms frame timing 


94.4 kbit/s 


108.8 kbit/s 







4.3.2 Slot allocation to channels 

For every channel, time slots can be allocated arbitrarily in a sequence of N rep 
slots which determines the length of a multi frame for which slot allocations re- 
peat. For v-channels, slots can be allocated to multiple connections and are 
dynamically arbitrated using the channel identity as described for v-channels in 
the LPRF specifications. 
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kPDC / D-AMPS system 



DC /D-AMPS 



LPRF sk> 



PDC / D-AMPS 



^ 5 



1011 



2)3|l4-j5 }l6}7|^8]9 fttf 1 ^^3.^5^6 



F[0] DU DU D U DU- 

V[0],V[2] -- D-U 

V[1] D D U D D U- -DDL) 

D = downlink slot 
U = uplink slot 

- = not allocated for this connection 

Figure 4. PDC/D-AMPS timing example 

Figure 4 gives and example how slots could be allocated at a certain time for 
the PDC phone. F[0] carried a 64 kbit/s audio stream and is allocated such that 
the delay is minimized (it is 11 slots = 8.46 ms). V[0] is basically the beacon and 
the allocated time slots are sharde with a low rate v-channel (V[2]) as well as a 
high rate v-channel (V[1]) which has as well assymetric capacity since twice as 
many downlink slots are allocated as uplink slots. Of course double slots carry 
only a single frame to optimize capacity (at 812.5 kbit/s the downlink capacity 
for V[1] would be 141 kbit/s). 

Clearly, power consumption can be optimized by reducing the number of re- 
quired receive activities for V[0] and V[2] while at the same time providing high 
throughput for other connections. 

However, with the exception of V[0], the allocations are not broadcasted but ne- 
gotiated. At least for V[0] the length of the allocation table need to be broad- 
casted. Furthermore, broadcasting of the multi-frame start is needed to syn- 
chronize-correctly; 

4.3.3 Handling of timing changes (TA + timing slips) 

4.4 Required system broadcast information 

Since initial contacts will usually be handled in the way as proposed for MC- 
link, no broadcast information is required to connect to a master that sends a 
paging or inquiry train. 

System broadcast information is only required if the allocation of slots to con- 
nections can vary even for the beacon transmissions on V[0] f which is actually 
assumed here. 

In this case the following information is needed: 



Radio system, compatible with cellular systems 



Copyright © Nokia Mobile Phones 



NOKIA 



CONFIDENTIAL 

R&D Center Germany 
Olaf J. Joeressen 



Draft v. 0.0+ 27 Nov 97 



10(11 ) 



- the length of the allocation sequence N rep 

- the position of the V[0] downlink (this may be always 0 !?) 

- the position of the V[0] uplink (in slots relative to downlink) 

- the MUs public identity 
Futhermore it might be useful to broadcast 

- sleep mode timing 

- worst case timing slip (!?) 

- additional information related to hopping 

- sleep mode flags 

- broadcast sequence number 

- country flags ( Japan !? ) 
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5 



Required change to make LPRF a frequency hopping 
system according to the proposed approach 



Advantages 



5.2 



Disadvantages 



5.3 



Additions/Changes 



- to facilitate easy slot change timing slip, the MU should broadcast a timing 
offset relative to a fixed hopping sequence such that the frequency after a 
timing slip is predictable. 

- support slot usage patterns and start flag for pattern to allocated capacity to 
links and enable low power modes 

- at least v-channelpatterh needs to be broadcasted 

- add radio resource management and access scheme to support frequency 
hopping 

- use different channel spacing + modulation scheme 

- upgrade to 1 Mbit/s (?) if neccessary 



- remove unneccessary timing parameter broadcasts for frame timing, max. 
timing slip 

- remove carrier change broadcast 

- remove radio resource management part needed for single carrier system, 
eg RSSI based carrier selection, beacon transmission (?), etc. 



- FEC options for traffic transmission 

- block protection option in TCH 

- ACC capacity extension on demand 

- courtesy mode for some services of master units to support service without 
registration 

- support for instantaneous network setup is probably needed 



5.4 



Things that can be removed 



5.5 



Nice to have 



[]i 



Radio system, compatible with cellular systems 
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